Hi there,
I have a small DMVPN setup where the Hub router is in Australia and 2 Spokes are in the U.K ... Equipment is all Cisco ... Now, what I want to know is that if U.K Spoke 1 wants to send traffic to U.K Spoke 2, does it send directly to U.K Spoke 2's interface or will it go to Hub first (i.e. Australia) and then send it back ?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
yes..that's what i thought so especially with NHRP there telling it to go to Hub server ...
Now, is there any other way that I can set it up to directly go to spoke instead of going to Hub ? It's just a bit inconveninent for those Spokes in U.K to come all the way to Australia (because the Hub router is in Australia) and then go back to U.K if they are to talk to each other ! What's your recommendation in such a scenario ?
Hi,
If I understood well NHRP is resolving is problem:
Protocol used by routers to dynamically discover the MAC address of other routers and hosts connected to an NBMA network. These systems then can communicate directly without requiring traffic to use an intermediate hop, increasing performance in ATM, Frame Relay, SMDS, and X.25 environments. Also used in DMVPN and mGRE tunnel networks.
Source: http://supportwiki.cisco.c
And rhis:
Dynamic Tunnel Creation for Spoke-to-Spoke Traffic
As stated earlier, currently in a mesh network, all point-to-point IPsec (or IPsec+GRE) tunnels must be configured on all the routers, even if some/most of these tunnels are not running or needed at all times. With the DMVPN solution, one router is the hub, and all the other routers (spokes) are configured with tunnels to the hub. The spoke-to-hub tunnels are up continuously, and spokes do not need configuration for direct tunnels to any of the other spokes. Instead, when a spoke wants to transmit a packet to another spoke (such as the subnet behind another spoke), it uses NHRP to dynamically determine the required destination address of the target spoke. The hub router acts as the NHRP server and handles this request for the source spoke. The two spokes then dynamically create an IPsec tunnel between them (via the single mGRE interface) and data can be directly transferred. This dynamic spoke-to-spoke tunnel will be automatically torn down after a (configurable) period of inactivity.
Source: http://www.cisco.com/en/US
A/
Correct ... That's how NHRP works ...
My question is if there is a way I can add extra config/tweak existing config so that the Spokes directly talk to each other rather than going via the Hub ?? ...
"The two spokes then dynamically create an IPsec tunnel between them (via the single mGRE interface) and data can be directly transferred" >> This is still going out via the hub (i.e. Spoke 1 -> Hub -> Spoke 2)
How can I bypass this condition ? Should I form another ipsec tunnel directly b/w the two routers (in addition to the existing tunnel config)
Hi,
I Advice you to set up a dynamic site to site VPN between the two spoke locations. If there is traffic for these sites it dynamically setup a site-2-site npn between this location. In stead of using the hub to connect to the other hub location.
The best way to set this up is with the Cisco Router SDM. You can downloa this tool free from the Cisco website. With this GUI it is very easy to set this up.
Good luck.
A/
Thanks for your post !
I'm more comfy with the CLI, never liked SDM -;)
However, I did setup an IPSEC tunnel between the two spokes sites ... but it doesnt seem to work ... am wondering if DMVPN tunnel can co-exist with an IPSEc tunnel on the same router ? If it does, then I'll troubleshoot further..If not, then I would know that there is no point in trying more !
Hi Nabeel92,
That is true, there is nothing better then the CLI. But for configuring VPN stuff, SDM is great ! It easy to use.
Co-existing IPSEC is no problem at all.
Take a look at figure 1 on the site: http://www.cisco.com/en/US
The two spoke routers has beside the dedicated VPN connection the dynamic SPOKE-2-SPOKE connections.
A/
Business Accounts
Answer for Membership
by: wiscomPosted on 2009-08-03 at 00:58:50ID: 25002478
Hi,
It will always go to the HUB !
Use NHRP
See vor more info: http://www.cisco.com/en/US
A/